DEBIAN-CVE-2021-26929

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/DEBIAN-CVE-2021-26929
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2021-26929.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2021-26929
Upstream
Published
2021-02-14T04:15:12Z
Modified
2025-09-18T05:19:12Z
Summary
[none]
Details

An XSS issue was discovered in Horde Groupware Webmail Edition through 5.2.22 (where the HordeTextFilter library before 2.3.7 is used). The attacker can send a plain text e-mail message, with JavaScript encoded as a link or email that is mishandled by preProcess in Text2html.php, because bespoke use of \x00\x00\x00 and \x01\x01\x01 interferes with XSS defenses.

References

Affected packages

Debian:11 / php-horde-text-filter

Package

Name
php-horde-text-filter
Purl
pkg:deb/debian/php-horde-text-filter?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Debian:12 / php-horde-text-filter

Package

Name
php-horde-text-filter
Purl
pkg:deb/debian/php-horde-text-filter?arch=source

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
2.3.7-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}